NUCLEAR SCIENCE AND TECHNIQUES 26, 050602 (2015) 


Framework analysis of fluoride salt-cooled high temperature reactor 
probabilistic safety assessment* 


ZUO Jia-Xu (Æ ¥Æ)B),! JING Jian-Ping (8 F),! BI Jin-Sheng (4E424£),! SONG Wei (R4), t and CHEN Kun (77) 


'The Nuclear and Radiation Safety Center, Ministry of Environmental Protection, Beijing 100082, China 
? Shanghai Institute of Applied Physics, Chinese Academy of Sciences, Shanghai 201800, China 
(Received June 4, 2015; accepted in revised form July 13, 2015; published online October 20, 2015) 


Probabilistic safety assessment (PSA) is important in nuclear safety review and analysis. Because the de- 
sign and physics of the fluoride salt-cooled high temperature reactor (FHR) differ greatly from the pressurized 
water reactor (PWR), the methods and steps of PSA in FHR should be studied. The high-temperature gas- 
cooled reactor (HTR-PM) and sodium-cooled fast reactors have built the PSA framework, and the framework 
to finish the PSA analysis. The FHR is compared with the PWR, HTR-PM and sodium-cooled fast reactors 
from the physics, design and safety. The PSA framework of FHR is discussed. In the FHR, the fuel and coolant 
combination provides large thermal margins to fuel damage (hundreds of degrees centigrade). The tristructural- 
isotropic (TRISO) as the fuel is independent in FHR core and its failure is limited for the core. The core damage 
in Level 1 PSA is of lower frequency. Levels 1 and 2 PSA are combined in the FHR PSA analysis. The initiating 
events analysis is the beginning, and the source term analysis and the release types are the target. Finally, Level 


3 PSA is done. 
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I. INTRODUCTION 


The WASH-1400 report of the 1970s is a milestone of 
probabilistic safety assessment (PSA) in safety assessment of 
nuclear power plant. After the Three Mile Island accident, 
the PSA was pushed to development and application. It has 
become increasingly important in the safety and operation as- 
sessment for nuclear power plants (NPPs), and NPPs in in- 
creasing numbers have been benefited from the PSA in their 
design and operation. 

Today, PSA is a necessary prerequisite for licensing of 
NPPs and is widely used in NPP design, safety analysis and 
operation. For the NPP types already in common use, either 
light water reactor (LWR) or heavy water reactor, the PSA 
technologies and methods are almost perfect. However, for 
reactors of advanced types, especially the non-LWR type of 
experiment reactor which is developing by us, in-depth study 
and discussions are required for the PSA methods. 


II. PSA METHODS AND FRAMEWORK IN LWR 


PSA of LWR NPPs provides a comprehensively structured 
approach to identify failure scenarios of NPPs. And the risk to 
staff and the public caused by NPPs are calculated. PSA de- 
scribes quantitatively the system risk of an NPP by the event 
tree and fault tree methods. It finds the weaknesses and pro- 
vides suggestion for improvements. The scope of data and 
understanding of the system decide the reliability and uncer- 
tainties of the PSA. 
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PSA is always divided into three levels. Level 1 PSA ana- 
lyzes the sequence of events which lead to core damage, and 
the core damage frequency (CDF) is estimated [1]. Level 1 
PSA provides insights into strengths and weaknesses of the 
safety-related systems and procedures in place or envisaged 
as preventing core damage. Level 2 PSA analyzes the re- 
sponses which lead to containment failure. These kinds of 
responses are caused by the results of Level 1 PSA. Level 2 
PSA identifies ways in which associated releases of radioac- 
tive materials from fuel can result in releases to the environ- 
ment. It also estimates the frequency, magnitude and other 
relevant characteristics of the release of radioactive materi- 
als to the environment [2]. In Level 3 PSA, public health 
and other societal consequences are estimated, such as the 
influence of the radioactive material release to the environ- 
ment [3]. Figure 1 shows the Levels 1, 2 and 3 PSA relation- 
ships and framework in the light-water reactors [4]. 


Table 1 shows the beginning and analysis target of PSA 
analysis in different levels, with which each level ensures the 
correctness and completeness of its PSA analysis. 


The initiating event analysis, a basic requirement for risk 
analysis, stars also the whole PSA analysis. Accuracy and 
completeness of the initiating events and grouping affect 
quality and results of the entire analysis. In order to ensure 
that the analysis can be implemented, the initiating events 
must be screened and grouped into one group with similar 
process or the same response [1, 5]. Level 1 PSA has two 
final states. One is accident mitigation success, described as 
“OK”, i.e. it will not lead to loss of the core integrity. The 
other leads to core damage (CD) and the loss of core integrity. 
It will be represented by “CD”. 


The severe accidents process and the source term release 
are studied and analyzed in Level 2 PSA. The risk of the se- 
vere accidents and uncertainties are quantitative and deter- 
mined. Level 2 PSA focuses on the CD sequences of the 
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Fig. 1. PSA framework of light water reactor. 


TABLE 1. The beginning of different level PSAs and analysis in PWR 


PSA Level Analysis target The beginning of analysis 

Level 1 The sequence of events leading to core damage, the estimated core Initiating event analysis and grouping 
damage frequency (CDF) 

Level 2 The responses which lead to containment failure from Level 1 PSA Plant damage state analysis and grouping 
results. The path of radionuclide release into the environment, and 
estimated the LERF/LRF 

Level 3 Estimate public health and other societal consequences. Radiation release type analysis and grouping 


Level 1. The sequences are grouped by the similar follow- 
up process. The groups are called the plant damage state 
(PDS) [6]. Usually, a PDS should have the key information 
in the CD sequence. And the kinds of information should be 
reflected and applied in Level 2 PSA analysis. To implement 
Level 2 PSA, the number of PDS should be controlled. PDS 
are mainly analyzed by the containment event tree (CET) to 
get the release category. 

Before Level 3 PSA analyses, the severe accident se- 
quences are grouped by similarity of the estimated release 
radiation. These kinds of group become the release category 
(RCs). Then the source term analysis for the release cate- 
gories is carried out. Firstly, the release categories and their 
properties are determined, and grouped. Then the source term 
analysis is done for the release categories. Finally, based on 
the results, the release categories are classified into source 
term groups. After this, the analysis goes into Level 3 PSA 
analysis. 


HI. PSA FRAMEWORK OF HIGH TEMPERATURE 
GAS-COOLED REACTOR 


High temperature gas-cooled reactor (HTR) and sodium- 
cooled fast reactor are among the six reactor types in the gen- 
eration IV (Gen-IV) nuclear energy systems in the world [7, 
8]. For safety of a Gen-IV reactor, it is important to improve 
its inherent safety, as its design and concept differ greatly 
from an LWR [9-11]. 


A. PSA framework of HTRs in USA, Germany and South 
Africa 


In the probabilistic safety analysis report of the modular 
high temperature gas-cooled reactor (MHTGR), designed by 
GA, USA, Levels 1 and 2 PSA are integrated [12]. The re- 
lease frequency and consequences are as the target of event 
tree analysis. Frequency of the release categories are ana- 
lyzed quantitatively by the events sequence [12]. 

Germany proposed the 200 MW pebble bed modular HTR 
(HTR-MODULE) design, and its probabilistic risk assess- 
ment is done. The initiating event, event tree and release 
categories are the framework of PSA. The release categories 
frequency is quantified by the events sequence [13]. 

The pebble bed modular reactor (PBMR) is developed by 
South African. The PSA of PBMR used the event tree analy- 
sis to model the initiating events, plant response, and the re- 
actor building response. And the development of accidents 
is modeled by PSA. The initiating events are divided into 
four categories, with 16 groups, and six release categories are 
defined as the final states [14]. 


B. PSA framework of HTR-PM in China 


The pebble-bed modular high-temperature gas-cooled re- 
actor (HTR-PM) is developed in China. The safety 
goal is that the cumulative frequency should be less than 
10~° reactor~tyear~+, for all beyond design basis accident 
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sequences which lead to off-site (including the site boundary) 
individual effective dose beyond 50 mSv [15]. 

Figure 2 shows the framework of HTR-PM’s PSA analy- 
sis [9, 10]. The initiating event, event tree and the release 
categories are as the framework of HTR-PM’s PSA. It begins 
with the initiating event analysis, and ends with the release 
categories analysis. The event tree considers release scenar- 
ios, rather than the plant response and operator intervention. 
Figure 2 shows the framework in the dotted line and the sup- 
port information outside the dotted line. 
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Fig. 2. PSA framework of HTR-PM [9, 10]. 


Compared with the framework of the pressurized water re- 
actor (PWR, Fig. 1), the boundaries between Levels | and 2 
PSA is cancelled, without CDF analysis, and the release cat- 
egories are directly used as the final state of events sequence. 
This is because of the special characteristics of HTR-PM, 
which uses spherical fuel element, termed as tristructural- 
isotropic (TRISO) fuel, and low-pressure containment. 

TRISO is UO, particles coated with the silicon carbide 
layer, the buffer layer, and the inner and outer pyrolytic car- 
bon layer. The coated particles ensure that there is a gap 
between the maximum core temperature and the temperature 
limit of the outermost layer in a reactor accident. So the core 
damage frequency is reduced greatly. Even it happens, the 
damage is inside the coated particles, which are independent 
of each other, without affecting other fuel particles. So, the 
radioactive release is limited greatly, hence no need of CDF 
calculation in PSA [10]. 

The modular design of HTR-PM is of low power TRISO 
fuel. In an reactor accident, the decay heat is transferred out- 
side the pressure vessel by radiation and conduction. Even if 
the coolant is lost, the core damage is of low frequency and 
the early radiation release is of low probability. The system 
of negative pressure ventilation and filtration in the contain- 
ment reduces the radiation emission to the environment. The 
helium coolant has excellent neutron properties and thermal 
stability, so the accident phenomena and processes are clearer. 


C. PSA framework of sodium cooled fast reactor 


From the safety review, the probabilistic safety goals for 
a fast reactor should be the same as the statement in the 
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HAD 102/17 (The safety evaluation and verification of nu- 
clear power plant). This means the CDF of less than 
10~° reactor~tyear~+, and the frequency of large radioac- 
tive release of less than 10~6 reactor~'year~! [16]. For the 
sodium-cooled fast reactor, the PSA method and framework 
are similar with PWR, but different greatly from HTR-PM. 

Based on PSA analysis in China Experimental Fast Reactor 
(CEFR), framework of the sodium-cooled fast reactor will be 
discussed. In the CEFR, Level 1 PSA was done, but Levels 
2 and 3 PSA are in the stage of planning. The framework in 
CEFR is almost the same with PWR, with main differences 
in detailed system analysis [17—19]. As shown in Fig. 3, for 
the sodium-cooled fast reactor, the PSA framework is divided 
into three levels, too. The analysis goals of each level PSA are 
the same as those of PWR, and analyzed the same as those in 
Table | [17, 18]. The core damage modes, which are closely 
related to designs of the reactor types, safety protection and 
accident mitigation system, can be divided into not meltdown 
(OK) and core damage (CD). 

But there are some differences between the sodium-cooled 
fast reactor and PWR, such as the neutron energy and coolant, 
good thermal capacity of sodium and active chemical proper- 
ties, etc. These make the details of PSA in sodium-cooled 
fast reactor different from PWR. For example, the initiat- 
ing events, success criteria, event tree analysis, and fault tree 
analysis are quite different. Also, the sodium-cooled fast re- 
actor is designed as non-pressure, with low pressure in its pri- 
mary and secondary loops. Therefore, the pressure-bearing 
containment is replaced by the airtightness confinement. This 
is the difference in concrete analysis of PSA [17, 18]. 


IV. PSA FRAMEWORK OF FHR 


Molten salt reactor concept originated in the 1950s and is 
mainly liquid reactor. Solid fuel molten salt coolant reactor 
was developed in 2001 [20, 21]. It uses coated particles as 
fuel and fluoride salt as coolant, with passive cooling safety 
systems. Base on the general design of FHR and the thorium- 
based molten salt reactor (TMSR-SF1) design in research at 
Shanghai Institute of Applied Physics, Chinese Academy of 
Sciences, the PSA framework of FHR is studied [22]. 


A. Characteristics of FHR 


The general characteristics of FHR are as follows. TRISO 
fuel pellets are used as fuel and the coolant is mixture of 
molten fluorine salts. It uses passive cooling safety systems 
are designed and supercritical water circulation system. Its 
maximum fuel temperature is about 1250°C under normal 
operation conditions. In the primary loop, the coolant is 2LiF- 
BeF, molten salt mixture; while in the secondary loop, the 
coolant is FLiNaK molten salt mixture. The maximum pres- 
sure in the reactor vessel is less than 0.5 MPa. The TRISO in 
the core is randomly arranged and the average temperature of 
core is around 600°C. Other systems include the protective 
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Fig. 3. PSA framework of Sodium-Cooled Fast Reactor. 
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Fig. 4. PSA framework of FHR. 


gas system, molten salt cleanup system and monitor system, 
etc. [23-27]. 

FHR has many outstanding features. Its particular coolant 
and fuel will have an impact on its PSA framework. In FHR 
the operating temperature of molten salt is far lower than the 
boiling point of 1430 °C for 2LiF-BeF2, which means a large 
gap as safety margin. In normal pressure, the fluoride salt 
is molten in high temperature, and the environment does not 
need to maintain a high pressure state. The TRISO fuel par- 
ticles fail at about 1600°C, which is much higher than the 
boiling point of the coolant temperature and average temper- 
ature of core. So the probability of core meltdown due to a 
temperature rise is greatly reduced [25]. 


B. PSA framework of FHR 


In PWR and sodium-cooled fast reactor, the fuel structural 
is fuel pellets and cladding composition. The damaged fuel 
cladding will result in radioactive leaks and fissile material. 
This will cause core damage. Therefore, Level 1 PSA of the 
two reactor types is to quantify the core damage and obtain 
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the core damage frequency. 

In FHR, the CDF caused by temperature rising up is re- 
duced. The TRISO failure temperature of 1600°C is much 
higher than the peak coolant temperature of 700°C, and 
higher than the boiling point of coolant (~ 1400 °C). So there 
is a large heat margins to extend the artificial non-intervention 
time and extend the accident processing time. From the 
physics, the TRISO damage is of such a lower frequency that 
it can be hardly happen. 


The TRISO fuel particles are independent of each other. So 
damage of one TRISO fuel particle does not affect other fuel 
particles. Because of its limited volume, the release of ra- 
dioactive fission products is limited. Therefore, similar to the 
HTR-PM, the large core damage and large radiation release 
of FHR is of lower frequency. 

As an experimental reactor, the FHR’s power density is 
lower than a power plant reactor. The containment in a power 
plant reactor can be replaced by the confinement. The PSA 
analysis method will be revised with this. 

Because of the low CDF, the PDS analysis in Level 2 PSA 
of PWR can be combined into the event tree quantification 
step in PSA of FHR, and Levels 1 and 2 PSA be combined in 
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TABLE 2. The Different Level PSAs in FHR 


PSA level Analysis target 


The beginning of analysis 


Combined Level | and Level 2 


Analyze the event tree and failure tree to quantification, 


Initiating event analysis and grouping 


and obtain source term to analyze the release category. 


Level 3 


FHR for the source term analysis. 

The PSA framework of FHR is similar with HTR. The 
boundary of Levels 1 and 2 PSA is not clearly in FHR PSA 
analysis. They can be combined. The beginning is the initiat- 
ing events analysis and grouping, followed by the event tree 
analysis and quantification. The release category and source 
term are the end of this part PSA analysis. Also the results 
of source term analysis are input of Level 3 PSA. The frame- 
work and detail process is shown in Fig. 4. The analysis tar- 
get and beginning of different level PSAs in FHR are shown 
in Table 2. 

The analysis and grouping of initiating events must follow 
the general standard, and this must be evaluated according 
to the reactor type and design. In the FHR’s PSA analysis, 
the event tree will not only consider a range of usually level 1 
PSA, but also should expand to the serious accident and relief. 
The performance and response of the confinement should be 
also considered. The corresponding fault tree will also ex- 
pand its model range which the event tree covered. Because 
there is similar physical state of coolant between the FHR and 
sodium cooled fast reactor, the initiating events and fault tree 
development could be referenced. 
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V. CONCLUSION 


The PSA is more and more important in the nuclear safety 
analysis and review. The method of PWR is perfection, but 
for the FHR and HTR the process of PSA is different with the 
PWR. From comparing the PSA framework of PWR, HTR- 
PM and sodium-cooled fast reactor, the PSA method and pro- 
cess of FHR have been studied. The different parts of FHR 
are similar with the HTR-PM or sodium-cooled fast reactor, 
so the PSA experience of them will be referenced. When we 
consider the FHR’s design characteristics, based on the exist- 
ing experience, the framework of FHR are established. The 
FHR’s PSA analysis will be developed by the combination of 
the level 1 and level 2 PSA. The beginning is the initiating 
events analysis and grouping. The end is the release category 
and source term analysis. The source term analysis will be 
the input of level 3 PSA. The PSA framework of FHR will be 
a guide of its PSA analysis. But some details of the analysis 
should be discussed. The PSA framework will also guide the 
safety design and analysis of FHR. 
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